The vulnerability causes the OpenID Connect client secret to be stored in plain text within the authentication.ps1 script for PowerShell Universal versions before 2026.1.3. An attacker who can read that script file can retrieve the client secret, enabling credential compromise and potential unauthorized access to protected resources.

Devolutions PowerShell Universal software is affected on all releases prior to version 2026.1.3. No specific sub‑versions are listed beyond this cutoff.

The Common Vulnerability Scoring System evaluates the severity at 5.5, indicating moderate risk. The exploit probability as measured by EPSS is below 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is therefore local or privilege‑relay: an actor must gain read access to the authentication.ps1 file, which may be achieved through misconfigured file permissions or compromised user accounts. The impact exists only for confidentiality of credentials; there is no direct denial of service or code execution identified.